SurrealDB Denial-of-Service Vulnerability via Uncaught Exception in rand::time() Function

A denial-of-service vulnerability has been identified in SurrealDB versions prior to 2.1.0. The issue arises from an uncaught exception in the rand::time() function, which generates a random time from an optional range of Unix timestamps. The function can return None, leading to a panic when unwrap is called, causing server crashes. Authorized clients can exploit this by repeatedly invoking rand::time(), reliably triggering server panics and causing a denial-of-service condition.

Impact

Exploitation of this vulnerability leads to server crashes, causing a denial-of-service condition where the server becomes unresponsive until manually restarted.

Remediation

Users can update to SurrealDB version 2.1.0 or later, where this vulnerability has been patched. Those unable to update may restrict untrusted clients from using the rand::time() function and ensure the SurrealDB process can automatically restart after a crash.